add actual send msg size for tcptop (iovisor#3997)

* add actual send msg size for tcptop

tools/tcptop.py

@@ -110,27 +110,39 @@ def range_check(string):
 };
 BPF_HASH(ipv6_send_bytes, struct ipv6_key_t);
 BPF_HASH(ipv6_recv_bytes, struct ipv6_key_t);
+BPF_HASH(sock_store, u32, struct sock *);
 
-static int tcp_sendstat(struct sock *sk, size_t size)
+static int tcp_sendstat(int size)
 {
  if (container_should_be_filtered()) {
  return 0;
  }
 
  u32 pid = bpf_get_current_pid_tgid() >> 32;
  FILTER_PID
-
- u16 dport = 0, family = sk->__sk_common.skc_family;
-
+ u32 tid = bpf_get_current_pid_tgid();
+ struct sock **sockpp;
+ sockpp = sock_store.lookup(&tid);
+ if (sockpp == 0) {
+ return 0; //miss the entry
+ }
+ struct sock *sk = *sockpp;
+ u16 dport = 0, family;
+ bpf_probe_read_kernel(&family, sizeof(family),
+ &sk->__sk_common.skc_family);
  FILTER_FAMILY
  
  if (family == AF_INET) {
  struct ipv4_key_t ipv4_key = {.pid = pid};
  bpf_get_current_comm(&ipv4_key.name, sizeof(ipv4_key.name));
- ipv4_key.saddr = sk->__sk_common.skc_rcv_saddr;
- ipv4_key.daddr = sk->__sk_common.skc_daddr;
- ipv4_key.lport = sk->__sk_common.skc_num;
- dport = sk->__sk_common.skc_dport;
+ bpf_probe_read_kernel(&ipv4_key.saddr, sizeof(ipv4_key.saddr),
+ &sk->__sk_common.skc_rcv_saddr);
+ bpf_probe_read_kernel(&ipv4_key.daddr, sizeof(ipv4_key.daddr),
+ &sk->__sk_common.skc_daddr);
+ bpf_probe_read_kernel(&ipv4_key.lport, sizeof(ipv4_key.lport),
+ &sk->__sk_common.skc_num);
+ bpf_probe_read_kernel(&dport, sizeof(dport),
+ &sk->__sk_common.skc_dport);
  ipv4_key.dport = ntohs(dport);
  ipv4_send_bytes.increment(ipv4_key, size);
 
@@ -141,26 +153,61 @@ def range_check(string):
  &sk->__sk_common.skc_v6_rcv_saddr.in6_u.u6_addr32);
  bpf_probe_read_kernel(&ipv6_key.daddr, sizeof(ipv6_key.daddr),
  &sk->__sk_common.skc_v6_daddr.in6_u.u6_addr32);
- ipv6_key.lport = sk->__sk_common.skc_num;
- dport = sk->__sk_common.skc_dport;
+ bpf_probe_read_kernel(&ipv6_key.lport, sizeof(ipv6_key.lport),
+ &sk->__sk_common.skc_num);
+ bpf_probe_read_kernel(&dport, sizeof(dport),
+ &sk->__sk_common.skc_dport);
  ipv6_key.dport = ntohs(dport);
  ipv6_send_bytes.increment(ipv6_key, size);
  }
+ sock_store.delete(&tid);
  // else drop
 
  return 0;
 }
 
+int kretprobe__tcp_sendmsg(struct pt_regs *ctx)
+{
+ int size = PT_REGS_RC(ctx);
+ if (size > 0)
+ return tcp_sendstat(size);
+ else
+ return 0;
+}
+
+int kretprobe__tcp_sendpage(struct pt_regs *ctx)
+{
+ int size = PT_REGS_RC(ctx);
+ if (size > 0)
+ return tcp_sendstat(size);
+ else
+ return 0;
+}
+
+static int tcp_send_entry(struct sock *sk)
+{
+ if (container_should_be_filtered()) {
+ return 0;
+ }
+ u32 pid = bpf_get_current_pid_tgid() >> 32;
+ FILTER_PID
+ u32 tid = bpf_get_current_pid_tgid();
+ u16 family = sk->__sk_common.skc_family;
+ FILTER_FAMILY
+ sock_store.update(&tid, &sk);
+ return 0;
+}
+
 int kprobe__tcp_sendmsg(struct pt_regs *ctx, struct sock *sk,
  struct msghdr *msg, size_t size)
 {
- return tcp_sendstat(sk, size);
+ return tcp_send_entry(sk);
 }
 
 int kprobe__tcp_sendpage(struct pt_regs *ctx, struct sock *sk,
  struct page *page, int offset, size_t size)
 {
- return tcp_sendstat(sk, size);
+ return tcp_send_entry(sk);
 }
 /*
  * tcp_recvmsg() would be obvious to trace, but is less suitable because: